When cookies are disabled and WebAuthentication is used to do programmatic login, the subsequent requests cannot access a secured resource in spite of specifying the jsessionid.

Code executed for first request -

String loginId = request.getParameter("userName");
String pwd = request.getParameter("password");

WebAuthentication pwl = new WebAuthentication();
pwl.login(loginId, pwd);

System.out.println(request.getSession().getId());

Next, access a secured resource using the sessionid printed above -

http://localhost:8080/tester/securepage.jsp;jsessionid=3DD43722A08682D91623FDE362D10275?key1=value1

This access does not go to securepage.jsp, instead takes the user back to login page.